Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\))
Subject: Re: [PATCH linux-5.9 1/1] net: netfilter: fix KASAN:
 slab-out-of-bounds Read in nft_flow_rule_create
From:   Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com>
In-Reply-To: <3BE1A64B-7104-4220-BAD1-870338A33B15@oracle.com>
Date:   Sun, 25 Oct 2020 16:31:57 -0700
Cc:     Pablo Neira Ayuso <pablo@netfilter.org>, stable@vger.kernel.org,
        linux-kernel@vger.kernel.org, kadlec@netfilter.org, fw@strlen.de,
        davem@davemloft.net, kuba@kernel.org,
        netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
        netdev@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <566D38F7-7C99-40F4-A948-03F2F0439BBB@oracle.com>
References: <20201019172532.3906-1-saeed.mirzamohammadi@oracle.com>
 <20201020115047.GA15628@salvia>
 <28C74722-8F35-4397-B567-FA5BCF525891@oracle.com>
 <3BE1A64B-7104-4220-BAD1-870338A33B15@oracle.com>
To:     Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com>,
        stable@vger.kernel.org
Precedence: bulk

Adding stable.


> On Oct 21, 2020, at 1:08 PM, Saeed Mirzamohammadi =
<saeed.mirzamohammadi@oracle.com> wrote:
>=20
> Attached the syzkaller C repro.
>=20
> Tested-by: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com>
> <repro.c>
>> On Oct 20, 2020, at 9:45 AM, Saeed Mirzamohammadi =
<saeed.mirzamohammadi@oracle.com> wrote:
>>=20
>> Thanks! Yes, that looks good to me.
>>=20
>> Saeed
>>=20
>>> On Oct 20, 2020, at 4:50 AM, Pablo Neira Ayuso <pablo@netfilter.org> =
wrote:
>>>=20
>>> On Mon, Oct 19, 2020 at 10:25:32AM -0700, =
saeed.mirzamohammadi@oracle.com wrote:
>>>> From: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com>
>>>>=20
>>>> This patch fixes the issue due to:
>>>>=20
>>>> BUG: KASAN: slab-out-of-bounds in nft_flow_rule_create+0x622/0x6a2
>>>> net/netfilter/nf_tables_offload.c:40
>>>> Read of size 8 at addr ffff888103910b58 by task =
syz-executor227/16244
>>>>=20
>>>> The error happens when expr->ops is accessed early on before =
performing the boundary check and after nft_expr_next() moves the expr =
to go out-of-bounds.
>>>>=20
>>>> This patch checks the boundary condition before expr->ops that =
fixes the slab-out-of-bounds Read issue.
>>>=20
>>> Thanks. I made a slight variant of your patch.
>>>=20
>>> I'm attaching it, it is also fixing the problem but it introduced
>>> nft_expr_more() and use it everywhere.
>>>=20
>>> Let me know if this looks fine to you.
>>> <0001-netfilter-fix-KASAN-slab-out-of-bounds-Read-in-nft_f.patch>
>>=20
>=20